IN THE CLAIMS 
Please amend the claims as follows: 

Claim 1 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which a confidential value corresponding to each tag ID information is stored in a 
confidential value memory of each tag device; comprising the steps of 
the tag device 

delivering tag output information which corresponds to a confidential value in the 
confidential value memory from an output section; 

and reading out at least part of elements of the confidential value from the 
confidential value memory, applying thereto a first function, an inverse image of which is 
difficult to obtain, and updating the confidential value in the confidential value memory with 
a result of such calculation by overwriting in a first calculator. 

Claim 2 (Original): A tag privacy protection method according to Claim 1 in which a 
second calculator of the tag device reads out the confidential value from the confidential 
value memory and applies a second function F2 which disturbs a relationship between 
elements of a definition domain and a mapping thereof to the confidential value read out, and 
a result of such calculation is the tag output information. 

Claim 3 (Original): A tag privacy protection method according to Claim 2 in which 
at least one of the first function Fl and the second function F2 is a hash function. 

Claim 4 (Original): A tag privacy protection method according to Claim 2 in which 
the first function Fl is a hash function H(x)=hash(p | x) where hash represents a hash function 
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for {0, 1} - {0, l} r , pe {0, 1} S and r and s are natural numbers and in which the second 
function F2 is a hash function G(x)=hash(q | x) where qe {0 5 1} S for p ?*q. 

Claim 5 (Original): A tag privacy protection method according to Claim 2 in which 
the first function Fl is a hash function H(x)=hash(pad(x, p)) where hash represents a hash 
function for {0, 1 {0, l} r ,pe {0, 1 } s , pad(x, p) represents a padding of p to x and r and s 
are natural numbers and in which the second function F2 is a hash function G(x)=hash(pad(x, 
q)) where pad(x, q) represents a padding of q to x and q e {0, 1 } s for p ?*q. 

Claim 6 (Original): A tag privacy protection method according to Claim 2 where the 
first function Fl is a hash function H(x) for {0, 1}*^ {0, l} r and r is a natural number and in 
which the second function F2 is a hash function G(x)=F(rx) where rx represents a bit 
inversion of x. 

Claim 7 (Original): A tag privacy protection method according to Claim 2 in which 
at least one of the first function Fl and the second function F2 is a common key encryption 
function. 

Claim 8 (Original): A tag privacy protection method according to Claim 2 in which 
the first function Fl and the second function F2 are an identical common key encryption 
function, to which different common keys are applied. 

Claim 9 (Currently Amended): A tag privacy protection method for preventing 
privacy information of a user from being acquired from information which is delivered from 
a tag device, in which a first confidential value s k , i corresponding to each tag ID information 
idk is stored in a confidential value memory of each tag device k (ke {1, . . ., m}, where m 
represents a total number of tag devices) and in which each tag ID information id n (ne {1, . . 
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m} and a corresponding second confidential value s n , i are stored in a database memory of a 
backend apparatus in a manner relating to each other; comprising the steps of 
the tag device 

reading out the first confidential value Sk, i from the confidential value memory, and 
applying a second function F2 which disturbs a relationship between elements of a definition 
domain and a mapping thereof to generate tag output information F2(sk, 0 in a second 
calculator; 

delivering the tag output information F2(sk, 0 from an output section; 

and reading out the first confidential value Sk, i from the confidential value memory, 
applying thereto a first function Fl, an inverse image of which is difficult to obtain, and 
saving a result of such calculation Fl(Sk,i) as new first confidential value Sk,i+i in the 
confidential value memory by overwriting in a first calculator; 

the backend apparatus 

accepting an input of the tag output information F2(Sk, 0 at an input section ; 

reading out the second confidential value Sn, i from the database memory, applying to 
each second confidential value Sn, i read out j times (j e {0, . . ., jmax}) the first function Fl and 
subsequently applying the second function F2 thereto in a third calculator ; 

comparing the tag output information F2(s k , 0 against the result of calculation 
F2(Fl j (sn, 0) in a comparator; 

in the event the tag output information F2(sk_4)- F2(sw ^) does not match the result of 
calculation F2(Fl J (s n , i)), the processings in the third calculator and the comparator being 
executed again by changing the value of at least one of n and j; 

and extracting by a reader the tag ID information id n which is related to the second 
confidential value s^ i corresponding to the matched result of calculation F2(Fl j (Sn, i)) from 



10 



the database memory when the tag output information FS^s^)- F2(sv i r) matches the result of 
calculation F2(Fl j (s n , i)). 

Claim 10 (Currently Amended): A tag privacy protection method for preventing 
privacy information of a user from being acquired from information which is delivered from 
a tag device, in which a first confidential value Sk, i and a first proper value Wk corresponding 
to each tag ID information id k are sored stored in a confidential value memory of each tag 
device k (ke {1, . . m}, where m represents a total number of tag devices) in a manner 
relating to each other and in which each tag ID information id n (ne {1 , . . ., m}) and a 
corresponding second confidential value Sn, i and a second proper value w n are stored in a 
database memory of a backend apparatus in a manner relating to each other; comprising the 
steps of 

the tag device 

reading out the first confidential value Sk, i from the confidential value memory and 
applying thereto a second function F2 which disturbs a relationship between elements of a 
definition domain and a mapping thereof to generate tag output information F2(s k , 0 in a 
second calculator; 

delivering the tag output information F2(s k , 0 from an output section; 

reading out the first confidential value s k , i and the first proper value w k from the 
confidential value memory, applying a first function Fl, an inverse image of which is 
difficult to obtain, to a bit combination value of the first confidential value and the first 
proper value, and saving a result of such calculation Fl(s k , i | w k ) as a new confidential value 
Sk, i+i in the confidential value memory by overwriting in a first calculator; 

the backend apparatus 

accepting an input of the tag output information F2(s k , 0 by an input section; 
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reading out the second confidential value Sn, 1 and the second proper value w n from the 
database memory, and applying the second function F2 to I j (n) where I J (n)=Sn f i (}=0) and 
I j (n)=Fl(I jl (n)) | id n ) 0^1) to calculate F2(I j (n)) in a third calculator; 

comparing the tag ID information F2(sk, 0 and a result of calculation F2(f(n)) in the 
third calculator in a comparator; 

in the event the tag output information F2(sk, 0 does not match the result of calculation 
F2(I J (n)), the processings in the third calculator and the comparator being executed again by 
changing the value of at least one of n and j; 

and in the event the tag output information F2(s kj 0 matches the result of calculation 
F2(I J (n)), extracting the tag ID information id n which is related to the second confidential 
value s n , i and the second proper value w n corresponding to the matching result of calculation 
F2(P(n)) from the database memory by a reader. 

Claim 1 1 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquiring from information which is delivered from a tag 
device, in which a first confidential value s k) i and a first proper value w k which correspond to 
each tag ID information id k are stored in a confidential value memory of each tag device k 
(ke {1, ., m}, where m represents a total number of tag devices) and in which a tag ED 
information id n (nE {1, . . m}) and a second confidential value s n , i and a second proper 
value w n which correspond thereto are stored in a database memory of a backend apparatus in 
a manner relating to each other; comprising the steps of 

the tag device 

reading out the first confidential value s k , i and the first proper value w k from the 
confidential value memory and applying to a bit combination value thereof a second function 
F2 which disturbs a relationship between elements of a definition domain and a mapping 
thereof to generate tag output information F2(s k , i | w k ) in a second calculator; 
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delivering the tag output information F2(sk, i | w k ) from an output section; 

and reading out the first confidential value s k , i from the confidential value memory, 
applying a first function Fl, an inverse image of which is difficult to obtain, to the first 
confidential value s k , i which is read out, and saving a result of such calculation Fl(sk, 0 as a 
new first confidential value Sk, i in the confidential value memory by overwriting in a first 
calculator; 

the backend apparatus 

accepting the tag output information F2(sk, i | w k ) as an input at an input section at an 
input section; 

reading out the second confidential value s^ i and the second proper value w n from the 
database memory, applying j times (j e {0, . . ., jmax}) the first function Fl to the second 
confidential value Sn, i to determine a bit combination value Fl j (sn, j) | w n of a resulting Fl j (Sn, 
i) and the second proper value w n , and applying the second function F2 to the bit combination 
value Fl j (Sn, 0 | w n in a third calculator; 

comparing the tag output information F2(s k , i | w k ) against a result of calculation in the 
third calculator F2(Fl J (s n , 0 | w n ) in a comparator; 

in the event the tag output information F2(Sk, i | w k ) does not match the result of 
calculation F2(Fl j (Sn, 0 | w n ), executing the processings in the third calculator and the 
comparator again by changing the value of at least one of n and j; 

and in the event the tag output information F2(s k , i | w k ) matches the result of 
calculation F2(Fl J (Sn, 0 | w n ), extracting the tag ID information id n which is related to the 
second confidential value s n , i and the second proper value w n corresponding to the matching 
result of calculation F2(Fl j (Sn, 0 | w n ) from the database memory by a reader. 
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Claim 12 (Currently Amended): A tag privacy protection method for preventing 
privacy information of a user from being acquired from information which is delivered from 
a tag device, in which a first proper value w k corresponding to each tag ID information idk 
and a first confidential value S\ which assumes an identical initial value s\ for a plurality of 
tag ID information are stored in a confidential value memory of each tag device k (ke {1, . . 
m}, where m represents a total number of tag devices), each tag ID information id n (ne {1, 
. . ., m}) and a corresponding second proper value w n are stored in a database memory of a 
backend apparatus in a manner relating to each other, and a first result of calculation Sj+i 
obtained by applying j times (j E {0, .. jmax}) a first function Fl to the second confidential 
value Si which is used in common by the plurality of tag ID information is stored in a 
calculated value memory of the backend apparatus; comrprising comprising the steps of 

the tag device 

reading out the first confidential value Si and the first proper value w k from the 
confidential value memory and applying to a bit combination value thereof a second function 
F2 which disturbs a relationship between elements of a definition domain and a mapping 
thereof to generate tag output information F2(si | w k ) in a second calculator; 

delivering the tag output information F2(Si | w k ) from an output section; 

and reading out the first confidential value Si from the confidential value memory, 
applying the first function Fl, an inverse image of which is difficult to obtain, to the first 
confidential value Si which is read out, and saves a result of such calculation Fl(si) as a new 
first confidential value Sj+i in the confidential value memory by overwriting in a first 
calculator; 

the backend apparatus 

accepting the tag output information F2(Si | w k ) as an input at an input section; 
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reading out a result of the first calculation sj+i and the second proper value w n from 
the database memory to obtain a bit combination value Sj+i | w n thereof, and applying the 
second function F2 thereto in a third calculator; 

comparing the tag output information F2(sj | w k ) against a result of the calculation by 
the third calculator F2(s J+ i | w n ) in a comparator; 

in the event the tag output information F2(Sj | Wk) does not match the result of the 
calculation F2(sj+i | w n ), executing the processings in the third calculator and the comparator 
again by changing the value of at least one of n and j; 

and in the event the tag output information F2(si | w k ) matches the result of the 
calculation F2(sj+i | w n ), extracting the tag ID information id n which is related to the second 
proper value w n corresponding to the matching result of calculation F2(s J+ i | w n ) from the 
database memory by a reader. 

Claim 13 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which a combination of d (d^2) elements e Uj vu (u€ {1, . . d}) corresponding to 
each tag ED information idk is stored in a confidential value memory of each tag device k 
(kE {1, . . m}, where m represents a total number of tag devices) and in which a 
combination of d initial elements f u>0 comprising one selected from each of d kinds (d^2) of 
subgroups (ue {1, . .., d}) and the tag ID information id n of each tag device n(ne{l, 
m}) are stored in a database memory of a backend apparatus in a manner relating to each 
other comprising the steps of; 

the tag device 

reading out the d elements e u , vu from the confidential value memory to form a bit 
combination value thereof which represents a confidential value Sk, i and applying a second 
function F2 which disturbs a relationship between elements of a definition domain and a 
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mapping thereof to the confidential value s k , i to generate tag output information a k) i=F2(s k , 0 
in a second calculator; 

delivering the tag output information a k> i from an output section; 

and extracting at least part of elements e u », vir (u 1 g { 1 , . . d}) from the confidential 
value memory, applying a first function Fl, an inverse image of which is difficult to obtain, 
to the extracted elements e u -, vus and saving a result of such calculation Fl(e U ', vu «) as new 
elements e U ', vu'+i in the confidential value memory by overwriting in a first calculator; 

the backend apparatus 

accepting the tag output information a k , j as an input at an input section; 

applying the first function Fl w u times (w u G {1, 2, max}) to d initial elements f u , o 
(ue {1, . . d» corresponding to the tag LD information id n , and applying the second function 
F2 to a bit combination value of these values Fl wu (f U) 0 ) to determine a calculated value c in a 
third calculator; 

comparing the tag output information a k , i against the calculated value c in a 
comparator; 

in the event the tag output information a k , i does not match the calculated value c, 
executing the processings in the third calculator and the comparator again by changing the 
value of at least part of n and w u ; 

and in the event the tag output information a k , \ matches the calculated value c, 
extracting tag ID information id n which is related to the combination of d initial elements f u>0 
corresponding to the calculated value c from the database memory by a reader. 

Claim 14 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which a combination of d (d^2) elements e UjVU (uG{l, ...,d}) which corresponds 
to each tag ID information id k and a proper value "ft which is inherent to each tag ED 
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information idk are stored in a confidential value memory of each tag device k (kG {1, . . ., 
m}, where m represents a total number of tag devices) and in which a combination of d (d^2) 
elements e u , vu (ue {1, . . d}) which corresponds to each tag ID information idk and a proper 
value > which is inherent to each tag ID information idk are stored in a database memory of a 
backend apparatus in a manner relating to each other; comprising the steps of 
the tag device 

reading out the d elements e Uj ^ and the proper value % from the confidential value 
memory, and applying a second function F2 which disturbs a relationship between elements 
of a definition domain and a mapping thereof to a confidential value s k , i which is a bit 
combination value of the d elements and the proper value to generate tag output information 
ak, i=F2(s k , i) in a second calculator; 

delivering the tag output information ak, i from an output section; 

and extracting at least part of elements e^vu' (u'e {1, d}) from the confidential 
value memory, applying a first function Fl, an inverse image of which is difficult to obtain, 
to the extracted elements e^, vu', and saving a result of such calculation Fl (e u «, vu') as new 
elements e u < 5 V u*+i in the confidential value memory by overwriting in a first calculator; 

the backend apparatus 

accepting the tag output information a k , i as an input at an input section; 

applying the first function Fl w u times (w u e {1,2, max}) to the d initial elements 
f u , o (ue {1 , . . ., d}) corresponding to the tag ID information id n and applying the second 
function F2 to a bit combination value of the function values Fl ^(fu, o) and the proper value 
7n to determine a calculated value c in a third calculator; 

comparing the tag output information ak, i against the calculated value c in a 
comparator; 



17 



in the event the tag output information ak, i does not match the calculated value c, 
executing the processings in the third calculator and the comparator again by changing the 
value of al least part of n and w u ; 

and in the event the tag output information ak, i matches the calculated value c, 
extracting tag ID information id n which is related to the combination the plurality of initial 
elements f u , o corresponding to the calculated value c from the database memory by a reader. 

Claim 15 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which d (d;> 1) elements e u , vu (ue {1, . . d}) are stored in a confidential value 
memory of each tag device k (ke {1, . . m}, where m represents a total number of tag 
devices), a manifold value z having t kinds (t^2) of values is stored in a first manifold value 
memory of each tag device k, a combination of d initial elements f U) 0 comprising one selected 
from each of d kinds (d^ 1) of subgroups o^(ue{l,.. ., d}) and tag ID information id n 
(ne {1, . . ., m}) of each tag device are stored in a database memory of a backend apparatus in 
a manner relating to each other, and the manifold value z is stored in a second manifold value 
memory of the backend apparatus; comprising the steps of 

the tag device 

reading out each element e u , vu from the confidential value memory and reading out 
either manifold value z from the first manifold value memory and applying a second function 
F2 which disturbs a relationship between elements of a definition domain and a mapping 
thereof to a confidential value Sk, i which is a bit combination value of the elements and the 
manifold value to generate tag output information ak, i=F2(s k , 0 in a second calculator; 

delivering the tag output information ak, i from an output section; 
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and extracting at least part of elements e U ', vu* (u 1 e { 1 , . . ., d}) from the confidential 
value memory each time the output section delivers the tag output information a kj i t times, 
applying a first function Fl, an inverse image of which is difficult to obtain, to the extracted 
elements e u -, vus and saving a result of such calculation Fl(e u -, vuO as new elements e u \ vu'+i in 
the confidential value memory by overwriting in a first calculator; 

the backend apparatus 

accepting the tag output information a k> \ as an input at an input section; 

applying the first function Fl w u times (w u e {1, 2, . . ., max}) to the d initial elements 
f u,o (ue {1, d}) corresponding to the tag ID information id n and applying the second 
function F2 to a bit combination value of these values Fl ^(fu, o) and the manifold value z to 
determine a calculated value c in a third calculator; 

comparing the tag output information a k , i against the calculated value c in a 
comparator; 

in the event the tag output information a k , i does not match the calculated value c, 
executing the processings in the third calculator and the comparator again by changing the 
value of at least part of n, w u and z; 

and in the event the tag output information a kj i matches the calculated value c, 
extracting the tag ID information id n which is related to the combination of the d initial 
elements f u , 0 corresponding to the calculated value c from the database memory by a reader. 

Claim 16 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which d (d^2) elements e u ,vu (ue {1, d» are stored in a confidential value 
memory of each tag device k (ke {1, . . ., m}, where m represents a total number of tag 
devices), a manifold value z u which assumes t u kinds (t u ^2) of values for each u is stored in a 
first manifold value memory of each tag device k, a combination of d initial elements f u , o 
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comprising one selected from each of d kinds (d^2) of subgroups (uG {1, d}) and tag 
ID information id n (nG {1, . . m}) of each tag device are stored in a database memory of a 
backend apparatus in a manner relating to each other, and the manifold value z u is stored in a 
second manifold value memory of the backend apparatus; comprising the steps of 
the tag device 

reading out each element e u> vu from the confidential value memory and reading out 
either manifold value z u for each u from the first manifold value memory and applying a 
second function F2 which disturbs a relationship between elements of a definition domain 
and a mapping thereof to a confidential value Sk, i which is a bit combination value of e u , vu 
and z u to generate tag output information a*, i=F2(sk, 0 in a second calculator; 

delivering the tag output information ak, i from an output section; 

extracting at least part of elements e u «, vu* (u* E {1, . . ., d}) from the confidential value 
memory each time the output section delivers the tag output information a k , j some number of 
times, applying a first function Fl, an inverse image of which is difficult to obtain, to the 
extracted elements e u -, v^, and saving a result of such calculation Fl(e u -, vu') as new elements e^, 
vu'+i in the confidential value memory by overwriting in a first calculator; 

the backend apparatus 

accepting the tag output information a^ i as an input at an input section; 

applying w u times (w u G{1,2,..., max}) the first function Fl to the d initial elements 
f Ut o(ue{l, d}) corresponding to the tag ID information id n , and applying the second 
function F2 to a bit combination value of these values Fl^fu, o) and the manifold value z u to 
determine a calculated value c in a third calculator; 

comparing the tag output information ak, i against the calculated value c in a 
comparator; 
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in the event the tag output information a^ i does not match the calculated value c, 
executing the processings in the third calculator and the comparator again by changing the 
value of at least part of n, w u and z u ; 

and in the event the tag output information ak, i matches the calculated value c, 
extracting tag ID information id n which is related to the combination of a plurality of initial 
elements f u , 0 corresponding to the calculated value c from the database memory by a reader. 

Claim 17 (Original): A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which a confidential value corresponding to tag ID 
information is stored; 

a second calculator connected to the confidential value memory for reading out the 
confidential value from the confidential value memory and for applying a second function F2 
which disturbs a relationship between elements of a definition domain and a mapping thereof 
to the confidential value which is read out to generate tag output information; 

an output section for delivering the tag output information; 

and a first calculator for reading out at least part of elements of the confidential value 
from the confidential value memory and for applying a first function Fl, a mapping of which 
is difficult to obtain, to the elements which are read out, with a result of such calculation 
being used to update the confidential value in the confidential value memory by overwriting. 

Claim 18 (Currently Amended): A backend apparatus for use in an automatic tag 
identification system comprising 

a database memory in which each tag ID information and a corresponding 
confidential value are related to each other; 
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an input section which accepts tag output information as an input; 

a calculator for applying a first function Fl which is used in a tag device some 
number of times to at least part of elements of the confidential value in the database memory 
and which then applies a second function which is used in the tag device th e r e rto thereto : 

a comparator for sequentially comparing a result of the calculation in the calculator 
against the tag output information; 

and a reader for extracting the tag ID information which is related to the confidential 
value corresponding to the matching result of calculation when a matching between the result 
of calculation and the tag output information is found from the database memory. 

Claim 19 (Original): A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which a first confidential value s kj i corresponding to 
tag ID information idk is stored; 

a second calculator connected to the confidential value memory for reading out the 
first confidential value s k , i from the confidential value memory and for applying a second 
function F2 which disturbs a relationship between elements of a definition domain and a 
mapping thereof to the first confidential value s k , i to generate tag output information F2(s k , 0; 

an output section for delivering the tag output information F2(s k , 0; 

and a first calculator connected to the confidential value memory for reading out the 
first confidential value s k> i from the confidential value memory, for applying a first function 
Fl, an inverse image of which is difficult to obtain, to the first confidential value and for 
saving a result of such calculation Fl(s k , 0 as a new first confidential value s k>i+ i in the 
confidential value memory by overwriting. 
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Claim 20 (Original): A tag device according to Claim 19, further comprising 
a counter for counting a number of times rn the first confidential value is updated, 
the output section also delivering information which specifies the number of updating 
times rn. 

Claim 21 (Original): A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which a first confidential value Sk, i and a first proper 
value w k which correspond to a tag ID information id k are stored; 

a second calculator connected to the confidential value memory for reading out the 
first confidential value Sk, i from the confidential value memory and for applying a second 
function F2 which disturbs a relationship between elements of a definition domain and a 
mapping thereof to the first confidential value to generate tag output information F2(sk, 0; 

an output section for delivering the tag output information F2(sk, 0; 

and a first calculator connected to the confidential value memory for reading out the 
first confidential value Sk, i and the first proper value w k from the confidential value memory, 
for applying a first function Fl, an inverse image of which is difficult to obtain, to a bit 
combination value of the first confidential value and the first proper value and for saving a 
result of such calculation Fl(sk, i | w k ) as a new first confidential value s k , i+i in the 
confidential value memory by overwriting. 

Claim 22 (Currently Amended): A backend apparatus for use in an automatic tag 
identification system comprising 
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a database memory in which each tag ID information id n (ne {1, . . m}, where m 
represents a total number of tag devices) and a second confidential value Sn, 1 corresponding 
thereto are related to each other; 

an input section which accepts tag output information F2(sk, 0 as an input; 

a third calculator connected to the database memory for reading out the second 
confidential value Sn, 1 from the database memory, applying j times (j E {0, . . jmax}) a first 
function Fl which is used in a tag device to each of the second confidential values Sn, 1 which 
are read out, and for subsequently applying a second function F2 which is used in the tag 
device; 

a comparator for comparing the tag output information F2(sk, 0 against a result of 
calculation in the third calculator F2(Fl j (s n , i)); 

a controller for causing the processings in the third calculator and the comparator to 
be executed again by changing the value of at least one of n and j in the event the tag output 
information ¥2^5^)- F2{Skj} and the result of calculation F2(Fl j (Sn, i)) do not match; 

and a reader connected to the database memory and operative when the tag output 
information FS^s^)- F2£sjcj) matches the result of the calculation F2(Fl j (Sn, 0) to extract the 
tag ED information id n which is related to the second confidential value Sn, i corresponding to 
the matching result of the calculation F2(Fl J (Sn, 0) from the database memory. 

Claim 23 (Currently Amended): A backend apparatus according to Claim 22 in 
which the input section accepts an input of information which specifies a number of times rn 
the first confidential value is updated in the tag device, the third calculator applies the first 
function Fl j=rn times to each of the confidential values s„, i which are read out and then 
applies the second function F2 thereto, and the controller causes the processings in the third 
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calculator and the comparator to be executed again by changing the value of n when the tag 
output information FS^sj*-*)- F2£sjcj} does not match the result of the calculation F2(Fl j (Sn, 0). 

Claim 24 (Original): A backend apparatus according to Claim 22 in which the 
database memory stores the result of the calculation F2(Fl j (s n> i)) in the third calculator in a 
manner relating it to the second confidential value Sn, i, and the comparator performs a 
comparing processing by using the result of the calculation F2(Fl J (Sn, 0) stored in the 
database memory. 

Claim 25 (Original): A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which each tag ID information id n (ne {1, . . m}) 5 a 
corresponding second confidential value s n> i and second proper value w n are stored in a 
manner relating to each other; 

a input section which accepts an input of tag output information F2(sk, 0; 

a third calculator connected to the database memory for reading out the second 
confidential value s n , i and the second proper value w n from the database memory and for 
applying a second function F2 to I j (n) where I j (n)=Sn, i (j=0), and P(n)=Fl(I j " l (n) | id n ) (j^ 1) to 
calculate F2(I J (n)); 

a comparator for comparing the tag output information F2(Sk, 0 against the result of 
the calculation in the third calculator F2(I J (n)); 

a controller for causing the processings in the third calculator and the comparator to 
be executed again by changing the value of at least one of n and j when the tag output 
information F2(Sk,0 does not match the result of the calculation F2(I j (n)); 
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and a reader for extracting tag ID information id n which is related to the second 
confidential value Sn, 1 and the second proper value w n corresponding to the matched result of 
calculation F2(I J (n)) from the database memory when a matching between the tag output 
information F2(sk, 0 and the result of the calculation F2(I J (n)) is found. 

Claim 26 (Original): A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which a first confidential value Sk, i and a first proper 
value w k corresponding to tag ID information idk are stored; 

a second calculator connected to the confidential value memory for reading out the 
first confidential value s k , i and the first proper value w k from the confidential value memory 
and for applying a second function F2 which disturbs a relationship between elements of a 
definition domain and a mapping thereof to a bit combination value of the first confidential 
value and the first proper value to generate tag output information F2(s k , i | w k ); 

an output section for delivering the tag output information F2(s k , i | w k ) 

and a first calculator connected to the confidential value memory for reading the first 
confidential value Sk, i from the confidential value memory, applying a first function Fl, an 
inverse image of which is difficult to obtain, to the first confidential value s k> i which is read 
out and saving a result of such calculation Fl(sk, 0 as a new first confidential value Sk, i+i in 
the confidential value memory by overwriting. 

Claim 27 (Original): A backend apparatus for use in an automatic tag identification 
system comprising 
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a database memory in which each tag ID information id n (ne {1, . . m}) and a 
corresponding second confidential value Sn, 1 and second proper value w n are stored in a 
manner relating to each other; 

an input section which accepts an input of tag output information F2(sk, i | Wk); 

a third calculator connected to the database memory for reading out the second 
confidential value s n , i and the second proper value w n from the database memory, applying j 
times (j € {0, . . jmax}) a first function Fl which is used in a tag device to the second 
confidential value Sn, i, determining a bit combination value Fl J (Sn, 0 | w n of a result of 
application Fl J (s n ,0 and the second proper value w n , and applying a second function F2 which 
is used in the tag device to the bit combination value Fl J (Sn, i | w n ); 

a comparator for comparing the tag output information F2(sk, i | Wk) against a result of 
calculation in the third calculator F2(Fl j (Sn, 0 | w n ); 

a controller for causing the processings in the third calculator and the comparator to 
be executed again by changing the value of at least one of n and j when the tag output 
information F2(s k , i | Wk) does not match the result of the calculation F2(Fl J (Sn, 0 | w n ); 

and a reader connected to the database memory for extracting the -tag ID information 
id n which is related to the second confidential value s n , i and the second proper value w n 
corresponding to the matched result of calculation F2(Fl j (Sn,i) | w n ) when a matching between 
the tag output information F2(sk, i | w k ) and the result of the calculation F2(Fl j (Sn, 0 | w n ) is 
found. 

Claim 28 (Original): A tag device for use in an automatic tag identification system 
comprising 
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a confidential value memory in which a first proper value w k corresponding to each 
tag ID information id k and a first confidential value Si which assumes an equal initial value Si 
for a plurality of tag ID information are stored; 

a second calculator connected to the confidential value memory for reading out the 
first confidential value Si and the first proper value w k from the confidential value memory 
and for applying a second function F2 which disturbs a relationship between elements of a 
definition domain and a mapping thereof to a bit combination value of the first confidential 
value and the first proper value to generate tag output information F2(sj | w k ); 

an output section for delivering the tag output information F2(sj | w k ); 

and a first calculator connected to the confidential value memory for reading out the 
first confidential value Si from the confidential value memory, applying a first function Fl, an 
inverse image of which is difficult obtain, to the first confidential value S, which is read out 
and saving a result of such calculation Fl(Si) as a new first confidential value Si+i in the 
confidential value memory by overwriting. 

Claim 29 (Original): A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which each tag ID information id n (ne {1, . . m}) and a 
corresponding second proper value w n are stored in a manner relating to each other; 

a calculated value memory in which first results of calculation sj+i are stored which 
are obtained by applying j times (j S {0, . . ., jmax}) a first function which is used in a tag 
device to a second confidential value Si which is used in common for a plurality of tag ID 
information; 

an input section which accepts an input of tag output information F2(si | w k ); 
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a third calculator connected to the database memory for reading out the first result of 
calculation Sj+i and the second proper value w n from the database memory to obtain a bit 
combination value thereof Sj+i | w n and for applying a second function F2 which is used in the 
tag device thereto; 

a comparator for comparing the tag output information F2(si | w k ) and the result of 
calculation in the third calculator F2(s J+ i | w n ); 

a controller for causing the processings in the third calculator and the comparator to 
be executed again by changing the value of at least one of n and j when the tag output 
information F2(sj | w k ) does not match the result of calculation F2(s j+ i | w n ); 

and a reader connected to the database memory for extracting the tag ID information 
id n which is related to the second proper value w n corresponding to the matched result of 
calculation F2(s J+ i | w n ) when a matching between the tag output information F2(si | w k ) and 
the result of calculation F2(sj+i | w n ) is found. 

Claim 30 (Original): A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which a combination of d (d^2) elements e u , vu (uG {1, 
. . d}) which corresponds to each tag ID information id k is stored; 

a second calculator connected to the confidential value memory for reading out the d 
elements e u , vu from the confidential value memory and for applying a second function F2 
which disturbs a relationship between elements of a definition domain and a mapping thereof 
to a confidential value s k , \ which is a bit combination value of the d elements to generate tag 
output information a kj i=F2(s k , i); 

an output section for delivering the tag output information a k , j; 
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and a first calculator connected to the confidential value memory for extracting at 
least part of elements e u \ vu* (u f e {1, . . ., d}) from the confidential value memory, for applying 
a first function Fl, an inverse image of which is difficult to obtain, to the extracted elements 
e u \ vu' and for saving a result of such calculation Fl (e u «, vuO as new elements e u *, vu'+i in the 
confidential value memory by overwriting. 

Claim 31 (Original): A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which a combination of d initial elements f Uj 0 comprising one 
selected from each of d kinds (d^2) of subgroups c^(u6{l, d}), and tag ID information 
id n of each tag device n (ne {1, . . m}, where m represents a total number of tag devices) are 
stored in a manner relating to each other; 

an input section for accepting an input of tag output information ak, i; 

a third calculator for applying w u times (w u e {1,2, . . ., max}) a first function Fl to 
the d initial elements f U) o(ue {1, ...,d}) which correspond to the tag ID information id n and 
for applying a second function F2 to a bit combination value of these values Fl ^(fu, o) to 
determine a calculated value c; 

a comparator for comparing the tag output information ak, i against the calculated 
value c; 

a controller for causing the processings in the third calculator and the comparator to 
be executed again by changing the value of at least part of n and w u when the tag output 
information ak, i does not match the calculated value c; 

and a reader connected to the database memory for extracting tag ID information id n 
which is related to the combination of d initial elements f u , o corresponding to the calculated 
value c when the tag output information ak, i matches the calculated value c. 
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Claim 32 (Original): A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which a combination of d (d^2) elements e u , vu (u€ {1, 
. . d}) which correspond to each tag ID information idk and a proper value which is 
inherent to each tag ID information idk are stored; 

a second calculator connected to the confidential value memory for reading out the d 
elements e u , vu and the proper value from the confidential value memory and for applying a 
second function F2 which disturbs a relationship between elements of a definition domain 
and a mapping thereof to a confidential value Sk, i which is a bit combination value of the d 
elements and the proper value to generate tag output information ak, i=F2(Sk, 0; 

an output section for delivering the tag output information ak, i; 

and a first calculator connected to the confidential value memory for extracting at 
least part of the elements e u -, V ir (u'G {1, . . d}) from the confidential value memory, applying 
a first function Fl, an inverse image of which is difficult to obtain, to the extracted elements 
eu', vu* and for saving a result of such calculation Fl(e u «, vu ) as new elements e u «, vu'+i in the 
confidential value memory by overwriting; 

Claim 33 (Original): A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which a combination of d initial elements f u ,o comprising one 
selected from each of d kinds (d^2) of subgroups Ou (ue {1, . . d}), a proper value 7 n which 
is inherent to each tag ID information id n (ne {1, . . m}) and each tag ID information id n are 
stored in a manner relating to each other; 

an input section for accepting an input of tag output information ak, i; 
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a third calculator for applying w u times (w u e {1, 2, . . max}) a first function Fl to 
the d initial elements f u , 0 (ue {1, . . d}) corresponding to the tag ID information id n and for 
applying a second function F2 to a bit combination value of these values Fl ^(fu, o) and the 
proper value 7 n to determine a calculated value c; 

a comparator for comparing the tag output information ak, i against the calculated 
value c; 

a controller for causing the processings in the third calculator and the comparator to 
be executed again by changing the value of at least part of n and w u when the tag output 
information ak, i does not match the calculated value c; 

and a reader connected to the database memory for extracting tag ID information id n 
which is related to the combination of a plurality of initial elements f u> 0 corresponding to the 
calculated value c from the database memory when a matching between the tag output 
information ak, i and the calculated value c is found. 

Claim 34 (Original): A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which d (d^ 1) elements e u , vu (uG {1, . . . , d}) are 

stored; 

a first manifold value memory in which a manifold value z which assumes t kinds 
(t^2) of values is stored; 

a second calculator connected to the confidential value memory and the first manifold 
value memory for reading out the elements e u , vu from the confidential value memory and for 
reading out either manifold value z from the first manifold value memory and for applying a 
second function F2 which disturbs a relationship between elements of a definition domain 
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and a mapping thereof to a confidential value Sk, i which is a bit combination value of the 
elements and the manifold value to generate tag output information a kj j=F2(sk, 0; 

an output section for delivering the tag output information a k , i; 

and a first calculator connected to the confidential value memory for extracting at 
least part of elements e u », V u f (u* e { 1 , . . d}) from the confidential value memory each time the 
output section delivers the tag output information a k> i t times, for applying a first function Fl, 
an inverse image of which is difficult to obtain, to the extracted elements e u «, vu f and for saving 
a result of such calculation Fl(e u -, vuO as new elements e u «, vu'+i in the confidential value 
memory by overwriting . 

Claim 35 (Original): A tag device according to Claim 34 in which as long as the first 
calculator does not update elements in the confidential value memory, the manifold value z 
used by the second calculator in generating the tag output information a k) i changes each time 
the tag output information a k , j is generated. 

Claim 36 (Original): A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which a combination of d initial elements f u ,o comprising one 
selected from each of d kinds (d^ 1) of subgroup %(ue{l, ...,d}) and a tag ID information 
id n (ne {1, . . m}) of each tag device are stored in a manner relating to each other; 

a second manifold value memory in which a manifold value z which assumes t kinds 
(t^2) of values is stored; 

an input section for accepting an input of tag output information a k , { ; 

a third calculator for applying w u times (w u e {1, 2, . . max}) a first function Fl to 
the d initial elements f u ,o (u6 {1, . . d}) in the database memory which correspond to the tag 
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ID information id n and for applying a second function F2 to a bit combination value of these 
values Fl ^(fu, o) and the manifold value z in the second manifold value memory to determine 
a calculated value c; 

a comparator for comparing the tag output information a kj j against the calculated 
value c; 

a controller for causing the processings in the third calculator and the comparator to 
be executed again by changing the value at least part of n, w u and z when the tag output 
information ak, i does not match the calculated value c; 

and a reader connected to the database memory for extracting the tag ID information 
id n which is related to the combination of d initial elements f u , o corresponding to the 
calculated value c from the database memory when a matching between the tag output 
information ak, i and the calculated value c is found. 

Claim 37 (Original): A tag device for use in an automatic tag identification system 
comprising 

a confidential value memory in which d (d>2) elements e u , vu (uG {1, d}) are 

stored; 

a first manifold value memory in which a manifold value z u which assumes t u kinds 
(t u ^2) of values for each u is stored; 

a second calculator connected to the confidential value memory and the first manifold 
value memory for reading out the elements e Uj vu from the confidential value memory and for 
reading out either manifold value z u for each u from the first manifold value memory and for 
applying a second function F2 which disturbs a relationship between elements of a definition 
domain and a mapping thereof to a confidential value Sk, i which is a bit combination value of 
these ey, vu and z u to generate tag output information ak, i=F2(Sk, 0; 
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an output section for delivering the tag output information a^ i; 

and a first calculator connected to the confidential value memory for extracting at 
least part of the elements e u », vu* (u f e { 1, . . ., d}) from the confidential value memory each time 
the output section delivers the tag output information a k , j some number of times, for applying 
a first function Fl, an inverse image of which is difficult to obtain, to the extracted elements 
eu»,vu'» and for saving a result of such calculation Fl(eu', vu') as new elements e u », vu*+i in the 
confidential value memory by overwriting. 

Claim 38 (Original): A tag device according to Claim 37 in which each time the 
output section delivers the tag output information ak, i, the first calculator extracts at least part 
of the elements e u », vu* from the confidential value memory, applies the first function Fl to the 
extracted elements e u «, vu- and saves a result of such calculation Fl(e u «, vu') as new elements e u «, 
vu'+i in the confidential value memory by overwriting. 

Claim 39 (Original): A tag device according to Claim 37 in which each time the 

d 

output section delivers the tag output information a^ i ^t u times, the first calculator 

u=l 

extracts at least part of the elements e u «, w from the confidential value memory, applies the 
first function Fl to the extracted elements e u «, vus and saves a result of such calculation Fl(e U ', 
vuO as new elements e u -, VU '+i in the confidential value memory by overwriting. 

Claim 40 (Original): A tag device according Claim 39 in which as long as the first 
calculator does not update the elements in the confidential value memory, a combination of 
manifold values z u (ue {1, . . ., d}) which are used by the second calculator in generating the 
tag output information a k , i changes each time the tag output information ak, i is generated. 
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Claim 41 (Original): A backend apparatus for use in an automatic tag identification 
system comprising 

a database memory in which a combination of d initial elements f u , o which comprises 
one selected from each of d kinds (d^ 1) of subgroups o^, (uG {1, . . d}) and tag ID 
information id n (ne {1, . . m}) of each tag device are stored in a manner relating to each 
other; 

a second manifold value memory in which a manifold value z u which assumes t u kinds 
(t u ^2) of values for each u is stored; 

an input section for accepting an input of tag output information a^, i; 

a third calculator for applying w u times (w u E {1, 2, max}) a first function Fl 
which is used in a tag device to the d initial elements f u ,o(uE {1, ...,d}) corresponding to the 
tag ID information id n and for applying a second function F2 which is used in the tag device 
to a bit combination value of these values F 1^(^,0) and the manifold value z u to determine a 
calculated value c; 

a comparator for comparing the tag output information a k , $ against the calculated 
value c; 

a controller for causing the processings in the third calculator and the comparator to 
be executed again by changing the value of at least part of n, w u and z; 

and a reader connected to the database memory for extracting tag ID information id n 
which is related to the combination of the d initial elements f u ,o corresponding to the 
calculated value c from the database memory when a matching between the tag output 
information a^, \ and the calculated value c is found. 
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Claim 42 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which privileged ID information sidh which is formed by privileging respective tag 
ID information idh is stored in a confidential value memory of each tag device; comprising 
the steps of 

the tag device 

reading out the privileged ID information sid h stored in the confidential value memory 
in a read/write section; 

and delivering the privileged ID information sidh to an updater which is provided 
externally of each tag device from a first output section; 

the updater 

accepting an input of the privileged ID information sid h at a first input section; 

generating new privileged ID information sidh, the association of which with the 
privileged ID information sidh is difficult to follow in an updating section; 

delivering the new privileged ID information sid h ' to the tag device from a second 
output section; 

the tag device further 

accepting an input of the new privileged ID information sidh* at a second input 
section; 

the read/write section of the tag device storing the new privileged ID information sidh' 
in the confidential value memory. 

Claim 43 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which the privileged ID information sidh which is a random value r h related to each 
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tag ID information idh is stored in a confidential value memory of each tag device h (he {1, 
. . m}, where m represents a total number of tag devices), and each tag ED information idh 
and privileged ID information sid h which is the random value rn related to the tag ID 
information id h are stored in a privileged ID memory of an updater which is provided 
externally of each tag device h in a manner relating to each other; comprising the steps of 
the tag device h 

reading out the privileged ID information sidh stored in the confidential value memory 
thereof in a first read/write section; 

and delivering the privileged ID information sid h to the updater from a first output 
section; 

the updater 

accepting an input of the privileged ID information sid h at a first input section; 

generating a new random value rh in a random value generator; 

selecting tag ID information idh corresponding to the privileged ID information sidh 
which is accepted as the input from the privileged ID memory and storing the new random 
value rh 1 in the privileged ID memory in a manner relating to new privileged ID information 
sidh 1 in a second read/write section; 

and delivering the new privileged ID information sidh' to the tag device h from a 
second output section; 

the tag device h further 

accepting an input of the new privileged ID information sid h f at a second input 
section; 

the read/write section of the tag device storing the new privileged ID information sidh 1 
in the confidential value memory. 
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Claim 44 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which privileged ID information sidh is stored in a confidential value memory of 
each tag device h(he{l, ...,m}, where m represents a total number of tag devices), the 
privileged ID information sidh including a first encrypted text according to a common key 
encryption technique which corresponds to each tag ID information idh and key ID 
information kidj of a common key kj used in the encryption (j £ {1, . . ., n}, where n represents 
a total number of tag devices), and each key ID information kidj sire stored and each common 
key kj in a key memory of an updater which is provided externally of each tag device h in a 
manner relating to each other; comprising the steps of 

the tag device h 

reading out the privileged ID information sidh stored in the confidential value memory 
thereof in a first read/write section; 

and delivering the privileged ID information sidh to an updater from a first output 
section; 

the updater 

accepts an input of the privileged ID information sidh at a first input section; 

extracting the common key kj corresponding to the key ID information kidj included 
in the privileged ID information sid h from the key memory by a second read/write section; 

decrypting the first encrypted text using the common key kj extracted by the second 
read/write section to extract tag ID information idh by an ID extractor; 

generating a second encrypted text, the association of which with the first encrypted 
text is difficult to follow, using the tag ID information id h extracted by the ID extractor and 
the common key kj which is used in the extraction in an encryptor; 
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and delivering new privileged ID information sidh 1 including the second encrypted 
text and the key ID information kidj of the common key kj to the tag device h from a second 
output section; 

the tag device h further 

accepting an input of the new privileged ID information sidh at a second input 
section; 

the first read/write section of the tag device storing the new privileged ID information 
sid h f in the confidential value memory. 

Claim 45 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which privileged ID information sidh is stored in a confidential value memory of 
each tag device h (he {1, . . ., m}, where m represents a total number of tag devices), the 
privileged ID information sid h including a first encrypted text according to a pubic key 
encryption technique which corresponds to each tag ID information idh and key ED 
information kidj for a key pair (skj, pkj) (where skj represents a secret key and pkj represents a 
public key, j G {1, . . ., n}, where n represents a total number of tag devices), and each key ID 
information kidj and each key pair (skj, pkj) in a key memory of an updater which is provided 
externally of each tag device h in a manner relating to each other; comprising the steps of 

the tag device h 

reading out the privileged ID information sidh stored in the confidential value memory 
in a first read/write section; 

and delivering the privileged ID information sidh to an updater from a first output 
section; 

the updater 
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accepting an input of the privileged ED information sidh at a first input section; 

extracting the key pair (skj, pkj) which corresponds to the key ED information kidj 
which is included in the privileged ED information sidh accepted as the input to the first input 
section by a second read/write section; 

decrypting the first encrypted text using the secret key skj extracted by the second 
read/write section to extract the tag ED information idh by an ID extractor; 

generating a second encrypted text, the association of which with the first encrypted 
text is difficult to follow, using the tag ID information idh extracted by the ED extractor and 
the public pkj which is extracted by the second read/write section by an encryptor; 

and delivering new privileged ID information sidh 1 including the second encrypted 
text and the key ED information kidj of the key pair (skj, pkj) to the tag device h from a second 
output section; 

the tag device h further 

accepting an input of the new privileged ID information sidh at a second input 
section; 

the read/write section storing the new privileged ID information sidh 1 in the 
confidential value memory. 

Claim 46 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which privileged ED information sidh is stored in a confidential value memory of 
each tag device h (he {1, . . ., m}, where m represents a total number of tag devices), the 
privileged ID information sid h including a first encrypted text according to re-encryptable 
public key encryption technique which corresponds to each tag ED information id h and key ID 
information kidj of the public key pkj (j e {1, . . ., n}, where n represents a total number of 
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keys), each key ID information kidj and each public key pkj are stored in a key memory of an 
updater which is provided externally of each tag device h in a manner relating to each other; 
comprising the steps of 
the tag device h 

reads out the privileged ID information sid h stored in the confidential value memory 
in a first read/write section; 

and delivers the privileged ID information sidh to an updater from a first output 
section; 

the updater comprising 

accepting an input of the privileged ID information sid h at a first input section; 

extracting the public key pkj which corresponds to the key ID information kidj 
included in the privileged ID information sidh which is accepted as the input to the first input 
section from the key memory by a second read/write section; 

re-encrypting the first encrypted text in the privileged ID information sidh using the 
public key pkj extracted by the second read/write section to generate a second encrypted text, 
the association of which with the first encrypted text is difficult to follow, by an encryptor; 

and for delivering new privileged ID information sidh 1 including the second encrypted 
text and the key ID information kidj of the public key pkj to the tag device h from a second 
output section; 

the tag device h further 

accept an input of the new privileged ID information sid h f at a second input section; 
the read/write section storing the new privileged ID information sidh 1 in the 
confidential value memory. 
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Claim 47 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which privileged ID information sidh which has privileged each tag ID information 
idh is stored in a confidential value memory of each tag device h (h € { 1 , . . m} , where m 
represents a total number of tag devices); comprising the steps of 

the tag device h 

reading out the privileged ID information sidh stored in the confidential value memory 
by a first read/write section; 

and delivering the privileged ID information sid h to a first updater which is provided 
externally of the tag device h from a first output section; 

the first updater 

accepting an input of the privileged ID information sidh at a first input section; 
determining tag ID information id h from the privileged ID information sidh by an ID 
extractor; 

and delivering the tag ID information idh to a second updater which is provided 
externally of the tag device h from a second output section; 
the second updater 

accepting an input of the tag ID information id h at a third input section; 

generating new privileged ED information sidh' which has privileged the tag ED 
information id h by an encryptor; 

and delivering the new privileged ID information sidh 1 to the tag device h from a third 
output section; 

the tag device h further accepting an input of the new privileged ED information sid h f 
at a second input section; 
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the read/write section storing the new privileged ID information sid h f in the 
confidential value memory. 

Claim 48 (Original): An updater for updating privileged ID information in a tag 
device, the updater being provided externally of the tag device and comprising 

a privileged ID memory for storing each tag ID information idh and privileged ED 
information sidh which is a random value r h which corresponds to the tag ID information idh 
in a manner relating to each other; 

a first input section which accepts an input of the privileged LD information sid h 
which is delivered from the tag device; 

a random value generator for generating a new random value r h ? ; 

a second read/write section connected to the privileged ID memory for selecting tag 
ID information id h which corresponds to the privileged ID information sidh which is accepted 
by the first input section as the input from the privileged ID memory and for relating this with 
the new random value r h f as new privileged ID information sidh* to be stored in the privileged 
ID memory; 

and a second output section for delivering the new privileged ID information sidh 1 to 
the tag device h. 

Claim 49 (Original): An updater for updating privileged ID information in a tag 
device, the updater being provided externally of the tag device and comprising 

a key memory for storing each key ID information kidj (j e { 1 , . . n} , where n 
represents a total number of keys) and each common key kj of a common key encryption 
technique in a manner relating to each other; 
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a first input section for accepting an input of privileged ID information sidh which 
includes a first encrypted text according to the common key encryption technique which 
corresponds to the tag ID information id h and key ID information kidj of the common key kj 
which is used in the encryption; 

a second read/write section connected to the key memory for extracting the common 
key k, which corresponds to the key ID information kidj which is included in the privileged 
ID information sidh from the key memory; 

an ID extractor for decrypting the first encrypted text using the common key k, which 
is extracted by the second read/write section to extract tag ID information id h ; 

an encryptor for generating a second encrypted text, the association of which with 
first encrypted text is difficult to follow, using the tag ID information idh extracted by the ID 
extractor and the common key kj which is used in the extraction; 

and a second output section for delivering new privileged ID information sidh* which 
includes the second encrypted text and the key ID information kidj for the common key kj to 
the tag device h. 

Claim 50 (Original): An updater for updating privileged ID information in a tag 
device, the updater being provided externally of the tag device and comprising 

a key memory for storing each key ID information kidj (j e {1, . . ., n}, where n 
represents a total number of keys) and each key pair (skj, pkj) (skj represents a secret key and 
pkj a public key) in a manner relating to each other; 

a first input section for accepting an input of privileged ID information sidh which 
includes a first encrypted text according to a public key encryption technique which 
corresponds to tag ID information id h and key ID information kidj for the public key pkj 
which is used in the encryption; 
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a second read/write section connected to the key memory for extracting the key pair 
(skj, pkj) which corresponds to the key ID information kidj which is included in the privileged 
ED information sid h accepted by the first input section as the input from the key memory; 

an ID extractor for decrypting the first encrypted text using the secret key skj 
extracted by the second read/write section to extract tag ID information id h ; 

an encryptor for generating a second encrypted text, the association of which with the 
first encrypted text is difficult to follow, using the tag ID information idh extracted by the ID 
extractor and the public key pkj extracted by the second read/write section; 

and a second output section for delivering new privileged ID information sidh* which 
includes the second encrypted text and the key ID information kidj for the key pair (skj, pkj) 
to the tag device h. 

Claim 5 1 (Original): An updater for updating privileged ID information in a tag 
device, the updater being provided externally of the tag device and comprising 

a key memory for storing each key ID information kidj (j e {1, . . ., n}, where n 
represents a total number of keys) and each public key pkj in a manner relating to each other; 

a first input section for accepting an input of privileged ID information sidh which 
includes a first encrypted text according to re-encryptable public key encryption technique 
which corresponds to tag ID information id h and key ID information kidj for the public key 
P^; 

a second read/write section connected to the key memory for extracting the public key 
pkj which corresponds to the key ED information kidj which is included in the privileged ID 
information sidh which is accepted by the first input section as the input from the key 
memory; 
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an encryptor for re-encrypting the first encrypted text which is included in the 
privileged ID information sid h using the public key pkj extracted by second read/write section 
to generate a second encrypted text, the association of which with the first encrypted text is 
difficult to follow; 

and a second output section for delivering new privileged ID information sidh which 
includes the second encrypted text and the key ID information kidj for the public key pkj to 
the tag device h. 

Claim 52 (Original): An updater according to one of Claims 49 to 51 in which the 
key ID information kidj is information which is shared by a plurality unrelated tag devices. 

Claim 53 (Original): An update solicitor for soliciting an updater to update 
privileged ID information in a tag device, the update solicitor being provided externally of 
the tag device and comprising 

a privileged ID input section to which a plurality of kinds of privileged ID's, which 
are re-encryptable encrypted texts corresponding to an identical tag ID information idh, are 
input; 

a privileged ID memory for storing a plurality of kinds of privileged ID's which are 
input thereto; 

a privileged ID extractor connected to the privileged ID memory for extracting one of 
privileged ID's from the privileged ID memory at a given opportunity; 

and a privileged ID output section for delivering the extracted privileged ID to the tag 

device. 
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Claim 54 (Currently Amended): A tag device for use in an automatic tag 
identification system comprising 

a privileged ID input section to which a plurality of kinds of privileged ID's, which 
are re-encryptable encrypted texts corresponding to an identical tag ID information idh, are 
input; 

a privileged ID memory for storing the plurality of kinds of privileged ID's which are 
input thereto; 

a privileged ID extractor connected to the privileged ID memory for extracting one of 
the privileged ID's from the privileged LD memory at a given opportunity; 

a privil e g e d ID e xtractor conn e ct e d to the privil e g e d ID memory for e xtracting on e of 
th e privil e g e d ID's from the privileg e d ID m e mory at a giv e n opportunity; 

and a privileged ID output section for delivering the extracted privileged ID. 

Claim 55 (Original): A tag privacy protection method for preventing privacy 
information of a user from being acquired from information which is delivered from a tag 
device, in which a key ID and a key are stored in a key memory in a manner relating to each 
other, the tag device comprises a privileged ID memory including a read-only region in 
which a key ID is stored and a rewritable region in which a first privileged ID is stored; 
comprising the steps of 

the tag device 

extracting the key ID and the first privileged ID from the privileged ID memory by a 
read/write section; 

and delivering the extracted key ID and first privileged ID to an updater from a first 
output section; 

the updater 
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accepting the key ID and the first privileged ID as inputs at a first input section; 

extracting a key which corresponds to the key ID which is input to the first input 
section from the key memory by a first key extractor; 

generating a second privileged ID, the association of which with the first privileged 
ID is difficult to follow, using the key extracted by the first key extractor and the first 
privileged ID which is input to the first input section in a privileged ID updating section; 

and delivering the second privileged ID from a second output section; 

the tag device further 

accepting an input of the second privileged ED at a second input section; 
the read/write section storing the second privileged ID in the rewritable region of the 
privileged ID memory. 

Claim 56 (Original): A tag privacy protection method according to Claim 55, further 
comprising the steps of 

the updater additionally including a verification information generator which 
generates a verification information for the second privileged ID; 

the second output section of the updater delivering the second privileged ID and the 
verification information; 

the second input section of the tag device accepting the second privileged ID and the 
verification information as inputs; 

the read/write section of the tag device storing the second privileged ID and the 
verification information in the rewritable region the of privileged ID memory. 

Claim 57 (Original): A tag privacy protection method according to Claim 55, further 
comprising the steps of 
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the read/write section of the tag device extracting the key ID from the read-only 
region of the privileged ID memory and extracting a third privileged ID from the rewritable 
region, the first output section of the tag device delivering the extracted key ID and the third 
privileged ID to a decryptor; 

the decryptor 

accepting the key ID and the first privileged ED as inputs at a third input section; 

extracting a key which corresponds to the key ID which is accepted by the third input 
section as an input from the key memory by a second key extractor; 

calculating an ID using the privileged ID which is input to the third input section and 
the key extracted by the second key extractor in an ID calculator; 

and verifying the structure of the calculated ID by an ID structure verifier. 

Claim 58 (Original): A tag device for use in an automatic tag identification system 
comprising 

a privileged ID memory including a read-only region in which a key ID is stored and 
a rewritable region in which a first privileged ID is stored; 

a read/write section for extracting the key ID and the first privileged ID from the 
privileged ID memory; 

a first output section for delivering the key ED and the first privileged ID which are 
extracted; 

and a second input section for accepting an input of a second privileged ID, the 
association of which with the first privileged ID is difficult to follow; 

the read/write section storing the second privileged ED which is input in the rewritable 
region of the privileged ID memory. 
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Claim 59 (Original): A tag device according to Claim 58 in which the second input 
section additionally accepts an input of verification information for the second privileged ID 
and the read/write section additionally stores the verification information which is input in 
the rewritable region of the privileged ID memory. 

Claim 60 (Original): A tag device according to Claim 58 in which the privileged ID 
represent information which is part of information constituting an ID and which is inherent to 
each tag device, which is privileged alone. 

Claim 61 (Original): A tag device according to Claim 58 in which an identical key 
ID is allocated to unrelated tag devices. 

Claim 62 (Original): A tag program for enabling a computer to function as a tag 
device according to one of Claims 17, 54 and 58. 

Claim 63 (Original): A tag program for enabling a computer to function as a backend 
apparatus according to Claim 18. 

Claim 64 (Original): An updating program for enabling a computer to function as an 
updater according to one of Claims 48 to 51. 

Claim 65 (Original): An update soliciting program for enabling a computer to 
function as an update solicitor according to Claim 53. 
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Claim 66 (Original): 
which enables a computer to 
58. 



A computer readable record medium storing a tag program 
function as a tag device according to one of Claims 17, 54 and 



Claim 67 (Original): A computer readable record medium storing a tag program 
which enables a computer to function as a backend apparatus according to Claim 18. 

Claim 68 (Original): A computer readable record medium storing an update program 
which enables a computer to function as an updater according to one of Claims 48 to 5 1 . 

Claim 69 (Original): A computer readable record medium storing an update 
soliciting program which enables a computer to function as an update solicitor according to 
Claim 53. 
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